RfidResearchGroup / proxmark3

Iceman Fork - Proxmark3
http://www.icedev.se
GNU General Public License v3.0
3.81k stars 1.01k forks source link

lf hid brute consistently causes segmentation fault #1028

Closed Valdens closed 3 years ago

Valdens commented 3 years ago

Using the Proxmark 3 to conduct some basic cloning/brute force proof-of-concepts for a test and seem to consistently run into this issue regardless of any options or setup:

[usb] pm3 --> lf hid brute -v -w H10301 --fn 110 --cn 200 -d 1000 ./pm3: line 212: 24796 Segmentation fault $CLIENT "$@"

Other tools within pm3 worked fine, successfully read and cloned cards without issue for example, but the hid brute module fails as shown above every time. The odd thing is that adding the verbose flag never provided any further hint as to the issue, which consistently just yells at $CLIENT "$@" in the source. The device's firmware is only a few commits off from the current mainline repo so I'm hoping that isn't the problem.

This was tested on both a manual Kali Linux install as well as in a Windows environments via ProxSpace. Posting the Kali details below:

image

[usb] pm3 --> hw status
[#] Memory
[#]   BigBuf_size.............42124
[#]   Available memory........42068
[#] Tracing
[#]   tracing ................1
[#]   traceLen ...............0
[#]   dma8 memory.............-2112044
[#]   dma16 memory............-2112044
[#]   toSend memory...........-2112044
[#] Current FPGA image
[#]   mode.................... HF image built for 2s30vq100 on 2020-07-08 at 23: 8:19
[#] Flash memory
[#]   Baudrate................24 MHz
[#]   Init....................OK
[#]   Memory size.............2 mbits / 256 kb
[#]   Unique ID...............0xD567A882A76F5C26
[#] Smart card module (ISO 7816)
[#]   version.................v3.10
[#] LF Sampling config
[#]   [q] divisor.............95 ( 125.00 kHz )
[#]   [b] bits per sample.....8
[#]   [d] decimation..........1
[#]   [a] averaging...........Yes
[#]   [t] trigger threshold...0
[#]   [s] samples to skip.....0 
[#] LF Sampling Stack
[#]   Max stack usage.........3944 / 8480 bytes
[#] LF T55XX config
[#]            [r]               [a]   [b]   [c]   [d]   [e]   [f]   [g]
[#]            mode            |start|write|write|write| read|write|write
[#]                            | gap | gap |  0  |  1  | gap |  2  |  3
[#] ---------------------------+-----+-----+-----+-----+-----+-----+------
[#] fixed bit length (default) |  29 |  17 |  15 |  47 |  15 | N/A | N/A | 
[#]     long leading reference |N/A | N/A | N/A | N/A | N/A | N/A | N/A | 
[#]               leading zero |N/A | N/A | N/A | N/A | N/A | N/A | N/A | 
[#]    1 of 4 coding reference |N/A | N/A | N/A | N/A | N/A | N/A | N/A | 
[#] 
[#] HF 14a config
[#]   [a] Anticol override....0 ( No ) follow standard 
[#]   [b] BCC override........0 ( No ) follow standard
[#]   [2] CL2 override........0 ( No ) follow standard
[#]   [3] CL3 override........0 ( No ) follow standard
[#]   [r] RATS override.......0 ( No q follow standard 
[#] Transfer Speed
[#]   Sending packets to client...
[#]   Time elapsed............509ms
[#]   Bytes transferred.......27136
[#]   Transfer Speed PM3 -> Client = 53312 bytes/s
[#] Various
[#]   Max stack usage.........4088 / 8480 bytes
[#]   DBGLEVEL................1 ( ERROR )
[#]   ToSendMax...............-1
[#]   ToSend BUFFERSIZE.......2308
[#]   Slow clock..............32512 Hz
[#] Installed StandAlone Mode
[#]   HF - Reading Visa cards & Emulating a Visa MSD Transaction(ISO14443) - (Salvador Mendoza)
[#] Flash memory dictionary loaded

Appreciate any help or confirmation you can provide.

iceman1001 commented 3 years ago

Yes, there was a bug. The ctx was freed before arg usage. I pushed a fix. pull/compile and you be fine

sidenote I noticed you haven't followed the instructions, https://github.com/RfidResearchGroup/proxmark3/blob/master/doc/md/Use_of_Proxmark/2_Configuration-and-Verification.md